Hackers Abuse Google Ads to Steal Users GoDaddy ManageWP login Credentials

Researchers uncovered the 'WrongPress' campaign in which attackers abuse Google Ads and cloaking to place a fake ManageWP login above the legitimate search result; victims who enter credentials (and 2FA codes) are relayed in real time through an AiTM proxy to the attackers and exfiltrated to a Telegram channel. Guardio Labs confirmed ~200 victims and accessed the operators' C2; because ManageWP accounts can control hundreds of WordPress sites, the campaign poses a high-impact risk. Recommended mitigations include avoiding sponsored search results for logins, bookmarking official URLs, monitoring for unexpected logins, and using phishing-resistant authentication (e.g., hardware keys).